{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EIn Scouting, there will be occasions where information from young people and their parents/guardians and adult volunteers will be required. Usually these will be ahead of events, camps or day trips or when a new member joins the Scouts. This page aims to provide you with some good practice guidance if you need to gather information.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Guidance on creating a data protection policy","buttonLink":{"name":"Guidance Template For Creating A Data Protection Policy","id":null,"url":"https://prod-cms.scouts.org.uk//media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhy do we need additional information?\u003C/h4\u003E\n\u003Cp\u003EBefore collecting any data on an individual, we need to remember the principles of the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA):\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003E\u003Cstrong\u003ELawful\u003C/strong\u003E \u2013 the data processing is aligned to a lawful basis, such as legitimate interest, consent, performance of a contract etc.\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EFairness\u003C/strong\u003E \u2013 would the data subject consider this processing activity fair?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ETransparency \u003C/strong\u003E\u2013 is it clear to the data subject what is happening with their personal data?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EPurpose\u003C/strong\u003E \u2013 can you explain the processing activity and is it justified?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EMinimisation\u003C/strong\u003E \u2013 the data being processed is kept to the minimum required for the purpose\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EStorage limitation\u003C/strong\u003E - how long is the personal data required and can you justify this?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccurate \u003C/strong\u003E- is the data accurate and up to date? Can it be updated going forward?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003ESecure \u003C/strong\u003E- is the data secure in use, storage and transfer?\u003C/li\u003E\n\u003Cli\u003E\u003Cstrong\u003EAccountability\u003C/strong\u003E \u2013 the organisation that is subject to the GDPR needs to have systems in place to ensure compliance and be able to evidence it.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAs part of the principles of purpose and minimisation, it\u2019s good to think about the information you may have already collected before asking for more. It\u2019s likely that you\u2019ll already hold a lot of information from when the young person or adult volunteer joined Scouting and therefore there is no requirement to gather it again. You\u2019ll then only be asking for limited information for each event.\u003C/p\u003E\n\u003Cp\u003EThat said, you have a valid reason for asking for some information again as it is an obligation of your Trustee Board that the data held is accurate and it may have changed, or be very specific for that event, for example an emergency contact may be a grandparent rather than the parent because the parents may be going away at the same time as your week-long summer camp.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EKeep things to a minimum\u003C/h4\u003E\n\u003Cp\u003EWhen designing your form, try to avoid collecting unnecessary data. For example you do not need to know if the young person can swim, if your event will not include any water activities in its programme. This can usually be a symptom of reusing forms and each form should be considered against its own purpose.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ELayout of the form\u003C/h4\u003E\n\u003Cp\u003EOften forms will be designed based on the need of the event or as you think of things to include on the form. It\u2019s worth taking a moment to think about the information you are collecting so that you can order it and maybe batch different kinds of information together.\u003C/p\u003E\n\u003Cp\u003EFor example, keeping names and contact details together. Keeping sensitive (special category) data together, such as medical details, will help the individual competing the form to follow its logic and for you to provide them with further description on the sections, if required. Where sensitive data is being gathered it is good practice to include a brief section explainer text so it\u2019s clear on the specific purpose for gathering it.\u003C/p\u003E\n\u003Cp\u003EWhere a form is capturing personal and/or sensitive personal data, you should include a Privacy Statement to assist in providing transparency for the individual completing the form. This should ideally be positioned at the top or bottom or top of a form so it\u2019s visible and read.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EPrivacy Statement\u003C/h4\u003E\n\u003Cp\u003EA Privacy Statement is required to provide the necessary transparency to the data subject and must include some basic detail, such as;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe type of data being collected\u003C/li\u003E\n\u003Cli\u003EWhy the information is being collected\u003C/li\u003E\n\u003Cli\u003EWhere the information will be stored\u003C/li\u003E\n\u003Cli\u003EDetails of who will have access to the information\u003C/li\u003E\n\u003Cli\u003EA time period for when you will destroy the information\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EYou should also include a link to the Scout Unit\u0027s agreed and published Data Protection/Privacy Policy.\u003C/p\u003E\n\u003Cp\u003EThe statement must be written in clear and simple language so that it is easy to understand by the individual completing your form.\u003C/p\u003E\n\u003Cp\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/co3jljdz/template-privacy-statement.docx\u0022 target=\u0022_blank\u0022 title=\u0022Template privacy statement\u0022\u003ECheck out our tool to help you create your privacy statement\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Privacy Statement template","buttonLink":{"name":"Template Privacy Statement","id":null,"url":"https://prod-cms.scouts.org.uk//media/co3jljdz/template-privacy-statement.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EConsent\u003C/h4\u003E\n\u003Cp\u003EConsent is a lawful basis for processing data and can only be presented as a choice, yes or no. This means that consent should only be used where necessary and where another lawful basis for processing does not exist.\u003C/p\u003E\n\u003Cp\u003EThere will be certain information, or conditions which require specific consent to be given. This will include, but is not limited to:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003ESensitive personal data where it is to be passed to a third party, such as when capturing registrations for an event and passing this data to an organisation assisting with that event\u003C/li\u003E\n\u003Cli\u003EAsking to use an image or video of someone\u003C/li\u003E\n\u003Cli\u003EUsing data for a different reason than the initial purpose it was collected\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe data subject will need to tick a box or sign their name to provide their consent. Implied or pre-filled boxes are not allowed, you need to be able to evidence that the data subject affirmatively gave their consent. Asking for consent for other information does come with the risk that consent can be retracted at any point, possibly making the organisation of an event harder.\u003C/p\u003E\n\u003Cp\u003ETake a look at an example of seeking consent:\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"imageWithLink","gtmId":"","gtmClass":"","image":"/media/vt3kzwoh/consent-box.png","width":1413,"height":182,"altText":"An example of a consent box for gathering personal data.","caption":"","link":{"name":"Consent box example","id":null,"url":"https://prod-cms.scouts.org.uk/media/vt3kzwoh/consent-box.png","newWindow":false,"target":"_blank"}},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EAdult and young people data \u2013 is there any difference?\u003C/h4\u003E\n\u003Cp\u003EFundamentally, there is no difference between adult and young people data. The processing of young people data should come with an extra layer of due diligence to ensure its processing is absolutely necessary and that the security of that data is appropriate.\u003C/p\u003E\n\u003Cp\u003EWhile a data breach or loss of any data is serious, a breach or loss of young people\u2019s data comes with a potential for greater reputational damage which could jeopardise the future of scouting not just locally, but nationally as well.\u003C/p\u003E\n\u003Cp\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/using-childrens-information-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022Using children\u0027s information on the ICO website\u0022\u003EThe ICO have produced specific guidance on Young Person\u2019s data\u003C/a\u003E.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat you do with the information when collected?\u003C/h4\u003E\n\u003Cp\u003EWhen your completed form is returned you need to think about where the information is stored and who will have access to it.\u003C/p\u003E\n\u003Cp\u003EIf your form is on paper, you will usually need to transfer the information to a spreadsheet or other digital system. Make sure you transfer the data accurately. Think where this electronic record is then saved and if you need to password protect it. You may be required to print off the spreadsheet to take with you on an event. You\u2019ll need to consider how many copies you print off and who will have access to them \u2013 keep this to a minimum where possible. If you\u2019re sharing the sheets with other Leaders, ensure you know how many copies you have made and that you are able to collect these back in at the end of the event.\u003C/p\u003E\n\u003Cp\u003EIf you\u2019re using an electronic collection method, where will the data actually be stored? Is this within the UK or within Europe? If not, you may wish to think about the provider you are using, as data stored outside of Europe will require an appropriate safeguard for that\u0026nbsp;data transfer. You can \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/\u0022 target=\u0022_blank\u0022 title=\u0022Guide to international transfers\u0022\u003Echeck out a list of countries currently considered adequate for data transfer, without additional safeguards, on the ICO website\u003C/a\u003E. Most service providers will publish this information on their websites, such as Google and Microsoft, however you may need to look or actually contact the company to ask them before using their service.\u003C/p\u003E\n\u003Cp\u003ELike the paper copies, you\u2019ll also need to ensure there\u2019s a privacy statement on the form and that you are able to delete the data when it\u2019s no longer required. Paper forms will need to be securely destroyed when not needed any more. One way would be to shred the paper forms.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003ERetention Period\u003C/h4\u003E\n\u003Cp\u003EThe period of time that you will need to keep the information following an event will vary depending on the type of data you have collected, and the possible reasons for keeping it. You will also need to refer back to any retention policy set by your Trustee Board.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s good practice to delete data when not required any further, even if this falls inside your retention period set. In some cases, data may need to be kept longer than the retention period for analytical or statistical purposes, in most cases this won\u2019t require the personal data to be present and should be anonymised as soon as possible.\u003C/p\u003E\n\u003Cp\u003EWe\u0027ve created a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy Template\u0022\u003ETemplate Data Retention Policy\u003C/a\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022\u0022 target=\u0022_blank\u0022 title=\u0022Template Data Retention Policy\u0022\u003E\u003C/a\u003E, which contains real Scouting examples. This has been created using a combination of the \u003Ca href=\u0022/about-us/policy/data-retention-policy/\u0022 title=\u0022Data Retention Policy\u0022\u003EUK HQ Data Retention Policy\u003C/a\u003E and examples from local Scouting. This template can be used by a local Scout Unit but may need tailoring to suit local processing activities.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"callToAction","gtmId":"","gtmClass":"","buttonText":"Open the Data Retention Policy template","buttonLink":{"name":"Data Retention Policy Template","id":null,"url":"https://prod-cms.scouts.org.uk//media/bufdptx1/data-retention-policy-template.docx","newWindow":false,"target":"_blank"},"colour":{"value":"0061ce","label":"0061ce"},"alignment":"left"},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/gw5esqec/guidance-template-for-creating-a-data-protection-policy.doc\u0022 target=\u0022_blank\u0022 title=\u0022Data Protection Policy guidance\u0022\u003EGuidance on creating a data protection policy\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/co3jljdz/template-privacy-statement.docx\u0022 target=\u0022_blank\u0022 title=\u0022Privacy statement template\u0022\u003EPrivacy Statement template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/bufdptx1/data-retention-policy-template.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Retention Policy template\u0022\u003EData Retention Policy template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 5","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","id":47222,"nodeName":"Step 5: Gathering data","title":"Step 5: Gathering data","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 5: Gathering data","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyMiJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/"}